-- Rollback for T7 awoooi read-only MCP Gateway seed.
-- Contract revisions are append-only; rollback revokes grants and deactivates the seeded read tools.

SELECT set_config('app.project_id', 'awoooi', FALSE);

UPDATE awooop_mcp_grants
SET
    is_revoked = TRUE,
    revoked_at = NOW(),
    revoked_by = 'rollback:t7_mcp_gateway_read_seed'
WHERE project_id = 'awoooi'
  AND agent_id IN ('pre_decision_investigator', 'post_execution_verifier')
  AND granted_by = 'migration:t7_mcp_gateway_read_seed'
  AND is_revoked = FALSE;

UPDATE awooop_mcp_tool_registry
SET
    is_active = FALSE,
    updated_at = NOW()
WHERE project_id = 'awoooi'
  AND tool_name IN (
      'k8s_get_pod_logs',
      'k8s_get_events',
      'k8s_describe_pod',
      'k8s_get_hpa_status',
      'k8s_get_node_conditions',
      'ssh_diagnose',
      'ssh_get_top_processes',
      'ssh_get_disk_usage',
      'ssh_get_memory_info',
      'ssh_get_container_logs',
      'ssh_get_container_status',
      'ssh_get_service_status',
      'ssh_check_port',
      'ssh_get_nginx_error_log',
      'ssh_get_swap_info',
      'prometheus_query',
      'prometheus_query_range',
      'prometheus_get_alert_history',
      'gold_metrics',
      'trace_url',
      'system_metrics',
      'query_logs',
      'error_logs_summary',
      'list_approvals',
      'get_approval',
      'list_incidents',
      'list_timeline',
      'read_file',
      'list_directory',
      'search_in_file',
      'list_dashboards',
      'get_dashboard',
      'get_panel_data',
      'generate_dashboard_url',
      'search_runbook',
      'get_index_stats',
      'argocd_list_apps',
      'argocd_get_app_status',
      'argocd_get_sync_history',
      'sentry_list_issues',
      'sentry_get_issue',
      'sentry_search_issues'
  );

DELETE FROM awooop_active_revisions
WHERE project_id = 'awoooi'
  AND contract_family = 'agent'
  AND contract_id IN ('pre_decision_investigator', 'post_execution_verifier');

UPDATE awooop_contract_revisions
SET lifecycle_status = 'revoked'
WHERE project_id = 'awoooi'
  AND contract_family = 'agent'
  AND contract_id IN ('pre_decision_investigator', 'post_execution_verifier')
  AND publisher_id = 'migration:t7_mcp_gateway_read_seed'
  AND lifecycle_status = 'active';
